US Cyber Agency Flags Four Flaws in Software That Runs Lab Control Rooms

The U.S. Cybersecurity and Infrastructure Security Agency published an advisory on Oct. 27, 2026, listing four vulnerabilities in EPICS Base, the open-source software that scientific and industrial facilities use to run their control systems. The EPICS Community has issued release 7.0.11 with the fixes, and CISA says every release up to and including 7.0.10 is affected.

EPICS Base links an operator's screen to the pumps, magnets and sensors on the other side of the control room. CISA lists it as deployed worldwide in the critical manufacturing sector. The agency says a successful attack on these flaws could crash a system, corrupt its memory, expose sensitive information or potentially run code of the attacker's choosing.

CISA rates one of the four critical: 9.8 out of 10 on CVSS, the standard severity scale, and 9.3 under that scale's newer version. It rates the other three high. The four carry the identifiers CVE-2026-114595 through CVE-2026-114598, and the advisory itself is ICSA-26-300-01.

CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it. Besides the upgrade, the agency repeats its standing advice for control systems: keep them off the public internet and behind firewalls that separate them from business networks. Where remote access is needed, CISA says to use a VPN and to keep it updated.

The advisory credits Shubham Raj of Cipher / Causal Security with reporting the four vulnerabilities to CISA.